4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700

General

Target
4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.exe
Size 601KB
Sample260807-pc7e5avdrg
SHA256 4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700
MD5 0ab08f591b8f186beb7f61c08e6af657
SHA1 7f12087996b0fd5cc096845197a49698f4f71639
SHA512 129e7e6211b9a55c955f4a1a549966806224c0bf3be09a7b50ba4e02c22bf915ff36c6ad39440189a13e4b98486e77e22215da964f4d7f9991b7f03098dafc77
SSDEEP 6144:aN7n63HpIOyo2Vy6MMSAoqiFaQNKglICXuWefy0ZDdNsOfivVzJcSX6MkVFOu/NX:acaI6KYQ4qIDRjVFzL36WppgKkBQ
TLSH
T182D45D26A65400FCE1B3D2F99E565802E672784A0334AEDF03D159A31F177E89F7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	api.ipify.org
1	api.ipify.org

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/memory/4696-4-0x00007FF777C00000-0x00007FF777C9D000-memory.dmp	suspicious_telegram_bot

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DD38197AB5EFB7430B7CA540940496C82090A03D\Blob = 030000000100000014000000dd38197ab5efb7430b7ca540940496c82090a03d02000000010000008c000000000000001c00000018000000000000000000000000000000020000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f007600690064006500720000000000000009000000010000000c000000300a06082b060105050703032000000001000000c5010000308201c13082012aa00302010202102f29de7e84db1a99466fb85cc9339bdf300d06092a864886f70d01010b05003016311430120603550403130b626c61636b6e696e6a6173301e170d3236303830373132313231315a170d3239303830373132313231315a3016311430120603550403130b626c61636b6e696e6a617330819f300d06092a864886f70d010101050003818d0030818902818100dae87f5c9686c8bdb30dfac292080ef4f2902e8b6320bf596d02e1e344480ed2c470df8f06bf0d35eddb7cf6ff86b6f18d251fa5adee0762c8a877073a311bd413f3034334af25611565e56d886cc49e399b66333b708ab0be2649141ec08df11c84eaf42c0548036e9deeff07d6b27a5e3aaa40074e997359fb6b064c3821ad0203010001a310300e300c0603551d130101ff04023000300d06092a864886f70d01010b05000381810053a12f1903f5e68a2e536c55204ece3f8cf6ccb12d443cfd839fb28c0e62b5ca04e3a2f11ab8f7214ae1227b7f8ee7aea700def4d62c0202b67eb335c8565f6fb63a5947840b7f80e3d86f3d398ed9d89056e70cbceba33c0613c73581e729580586b14a4de2d5f7f450d9e406d1ef63d674d65653de8db4805c4051a298efb6	4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DD38197AB5EFB7430B7CA540940496C82090A03D\Blob = 0f0000000100000020000000c8492182bfd73435aabf0e315e277624a77c37fbe0099fda98866b537eb6316209000000010000000c000000300a06082b0601050507030302000000010000008c000000000000001c00000018000000000000000000000000000000020000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f0076006900640065007200000000000000030000000100000014000000dd38197ab5efb7430b7ca540940496c82090a03d2000000001000000c5010000308201c13082012aa00302010202102f29de7e84db1a99466fb85cc9339bdf300d06092a864886f70d01010b05003016311430120603550403130b626c61636b6e696e6a6173301e170d3236303830373132313231315a170d3239303830373132313231315a3016311430120603550403130b626c61636b6e696e6a617330819f300d06092a864886f70d010101050003818d0030818902818100dae87f5c9686c8bdb30dfac292080ef4f2902e8b6320bf596d02e1e344480ed2c470df8f06bf0d35eddb7cf6ff86b6f18d251fa5adee0762c8a877073a311bd413f3034334af25611565e56d886cc49e399b66333b708ab0be2649141ec08df11c84eaf42c0548036e9deeff07d6b27a5e3aaa40074e997359fb6b064c3821ad0203010001a310300e300c0603551d130101ff04023000300d06092a864886f70d01010b05000381810053a12f1903f5e68a2e536c55204ece3f8cf6ccb12d443cfd839fb28c0e62b5ca04e3a2f11ab8f7214ae1227b7f8ee7aea700def4d62c0202b67eb335c8565f6fb63a5947840b7f80e3d86f3d398ed9d89056e70cbceba33c0613c73581e729580586b14a4de2d5f7f450d9e406d1ef63d674d65653de8db4805c4051a298efb6	4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\DD38197AB5EFB7430B7CA540940496C82090A03D	4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\DD38197AB5EFB7430B7CA540940496C82090A03D\Blob = 030000000100000014000000dd38197ab5efb7430b7ca540940496c82090a03d02000000010000008c000000000000001c00000018000000000000000000000000000000020000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f007600690064006500720000000000000009000000010000000c000000300a06082b060105050703032000000001000000c5010000308201c13082012aa00302010202102f29de7e84db1a99466fb85cc9339bdf300d06092a864886f70d01010b05003016311430120603550403130b626c61636b6e696e6a6173301e170d3236303830373132313231315a170d3239303830373132313231315a3016311430120603550403130b626c61636b6e696e6a617330819f300d06092a864886f70d010101050003818d0030818902818100dae87f5c9686c8bdb30dfac292080ef4f2902e8b6320bf596d02e1e344480ed2c470df8f06bf0d35eddb7cf6ff86b6f18d251fa5adee0762c8a877073a311bd413f3034334af25611565e56d886cc49e399b66333b708ab0be2649141ec08df11c84eaf42c0548036e9deeff07d6b27a5e3aaa40074e997359fb6b064c3821ad0203010001a310300e300c0603551d130101ff04023000300d06092a864886f70d01010b05000381810053a12f1903f5e68a2e536c55204ece3f8cf6ccb12d443cfd839fb28c0e62b5ca04e3a2f11ab8f7214ae1227b7f8ee7aea700def4d62c0202b67eb335c8565f6fb63a5947840b7f80e3d86f3d398ed9d89056e70cbceba33c0613c73581e729580586b14a4de2d5f7f450d9e406d1ef63d674d65653de8db4805c4051a298efb6	4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\DD38197AB5EFB7430B7CA540940496C82090A03D\Blob = 14000000010000001400000036020b944f70c3af2057edc70934f7269c844e1209000000010000000c000000300a06082b0601050507030302000000010000008c000000000000001c00000018000000000000000000000000000000020000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f0076006900640065007200000000000000030000000100000014000000dd38197ab5efb7430b7ca540940496c82090a03d2000000001000000c5010000308201c13082012aa00302010202102f29de7e84db1a99466fb85cc9339bdf300d06092a864886f70d01010b05003016311430120603550403130b626c61636b6e696e6a6173301e170d3236303830373132313231315a170d3239303830373132313231315a3016311430120603550403130b626c61636b6e696e6a617330819f300d06092a864886f70d010101050003818d0030818902818100dae87f5c9686c8bdb30dfac292080ef4f2902e8b6320bf596d02e1e344480ed2c470df8f06bf0d35eddb7cf6ff86b6f18d251fa5adee0762c8a877073a311bd413f3034334af25611565e56d886cc49e399b66333b708ab0be2649141ec08df11c84eaf42c0548036e9deeff07d6b27a5e3aaa40074e997359fb6b064c3821ad0203010001a310300e300c0603551d130101ff04023000300d06092a864886f70d01010b05000381810053a12f1903f5e68a2e536c55204ece3f8cf6ccb12d443cfd839fb28c0e62b5ca04e3a2f11ab8f7214ae1227b7f8ee7aea700def4d62c0202b67eb335c8565f6fb63a5947840b7f80e3d86f3d398ed9d89056e70cbceba33c0613c73581e729580586b14a4de2d5f7f450d9e406d1ef63d674d65653de8db4805c4051a298efb6	4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DD38197AB5EFB7430B7CA540940496C82090A03D	4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4696	4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.exe
4696	4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4696	4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.exe

C:\Users\Admin\AppData\Local\Temp\4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.exe
"C:\Users\Admin\AppData\Local\Temp\4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.exe"
1⤵
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:4696